# Orchestrator Continuous Wake + Root Recovery

Status: working
Date: 2026-08-21

## Problem discovered during first dogfood run

Run `run_7a9a2217-edc1-41ed-9eb6-7dfda2048eba` proved that child ChatGPT workers can run successfully while the logical `/root` worker has no bound visible ChatGPT conversation. Lane A completed and sent a terminal handoff to root; Lane B sent blocker/progress messages; Lane C continued independently. Because `/root` had `conversation = null`, no visible coordinator conversation was guaranteed to consume those events.

This is an orchestration correctness defect, not merely a UI-labeling issue.

## Durable decisions

1. Logical workers, including `/root`, are durable identities. A ChatGPT conversation is a replaceable execution lease, not the identity itself.
2. Root provenance must be explicit: run stores concise main task name and root conversation name; workers store owner-readable display name and task summary.
3. New worker bootstrap/follow-up messages start with an owner-readable first line containing main task/lane, root conversation and task summary. Full objective/scope/acceptance criteria follow before execution instructions.
4. Worker lanes should normally render as `<main task name> Lane A/B/C/...`.
5. Missing/closed worker conversation is recoverable by creating a fresh managed ChatGPT conversation attached to the same logical worker and durable assignment/run state.
6. Primary continuation is backend-owned, using three wake classes: event wake, idle wake, active keepalive wake.
7. Active keepalive current working assumption: around a jittered 20–21 minute deadline, send/queue an **orchestrator checkpoint** even if the ChatGPT conversation is still generating. The checkpoint asks the worker to report latest commit(s), completed/current/remaining work, blockers and contract changes durably to `/root`, then explicitly tells it to continue working to completion. This may reset/extend the upstream per-turn timer; assumption remains provisional pending more empirical data.
8. Anti-spam: non-idle checkpoint/continuation deliveries to one lane must be at least 15 minutes apart. Early wakes are queued durably for the earliest legal send time. Idle may bypass the floor.
9. Workers continuously report checkpoint commits/progress/blockers/contracts to root via durable orchestrator events/messages. Root is woken by those reports, updates durable run status, reviews each lane against the larger plan/architecture/ownership/dependencies, and routes corrective or coordinating guidance while work is still in progress.
10. Normal `continue_as_planned` steering obeys the 15-minute non-idle floor. Material corrective steering may bypass that floor when delay would knowingly allow a lane to continue deviating; corrections remain durable, deduplicated and exactly-once. Git commit observation is a progress/wake signal, never a completion signal. `worker.complete` remains authoritative.
11. LibreWolf/plugin continuation remains planned as a final defense-in-depth dead-man layer for catastrophic cases such as all root/worker conversations errored/timed out and normal mutual wake paths unavailable. It must not become an independent scheduler.

## Current first dogfood state at discovery

- Lane A: completed; branch `impl/continuity-a-domain`; terminal handoff reported SHA `f397c4db85d7a5304414ff7736d5a1e9852bf5f2`.
- Lane B: running; reported scheduler-blocking Lane A contract issues and is patching minimal convergence deltas in its branch.
- Lane C: later reached completed state in durable worker state.
- `/root`: logical state `running`, no conversation binding.

## Current implementation in main WIP

- owner-readable `taskName`, `rootConversationName`, `displayName`, `taskSummary` metadata;
- `run.update_context` MCP operation;
- owner-visible bootstrap/follow-up prompt header and scope disclosure;
- orphan/missing-conversation follow-up may relaunch the same logical worker;
- tests for root orphan recovery and lane label generation.

## Next actions

1. Land current provenance/root-recovery implementation after gates.
2. Deploy updated MCP service.
3. Update the existing dogfood run context to readable names.
4. Relaunch/rebind the existing logical `/root` into a visible managed ChatGPT conversation without restarting the run.
5. Root recovery prompt must inspect current worker list, messages/events and branches, consume Lane A terminal handoff + Lane B blockers + Lane C terminal/current state, then continue convergence.
6. Notify active lane implementations of the new timer/event/progress rules so Slice 2 implements the agreed semantics.
7. Implement durable jittered checkpoint keepalive + anti-spam queue in the appropriate convergence lane/backend, including mid-turn LibreWolf/ChatGPT UI steering while generating and mandatory lane-to-root status reports.
8. Keep plugin dead-man fallback for the final hardening slice.